Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Data Domain OS lets any local user steal web sessions

CVE-2016-0910 · published 10 years ago
Summary

Versions of EMC Data Domain OS (5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0) store web‑interface session IDs in a file that anyone on the system can read. This allows a person with local access to take over other users' accounts through the graphical interface. Apply the latest software updates from EMC to secure the session storage.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
emc data_domain_os <= 5.5.3.3
<= 5.6.1.0
<= 5.7.1.0
cpe:2.3:o:emc:data_domain_os:*:*:*:*:*:*:*:*
Original advisory text
EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary ac...
EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published10 Jun 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-0910 · NVD
Track software like this
Free during beta